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Audience 


RealNetworks® RealSystem® Proxy 8 (Proxy 8), as part of the RealSystem iQ, introduces new 
technologies —called Neuralcast Technologies —for intelligent media delivery through 
distributed networks, ensuring the reliable delivery of your broadcasts. This white paper is 
targeted at system administrators, architects, and technology managers interested in deploying 
Proxy 8 for any of the following purposes: 


- Managing streaming media over a network 
+ Delivering live broadcasts over a network 


+ Caching on-demand content for delivery over a network 


Introduction 


This white paper highlights the features and benefits of deploying RealSystem® Proxy 8 inan 
enterprise or intranet environment. It assumes a general understanding of network 
architecture and IP protocols, as well as familiarity with streaming media technologies 
developed at RealNetworks. For a better understanding of these new technologies, see the 
glossary and the links to other resources at the end of this paper. 


For additional configuration and usage information, see the RealProxy Administration Guide at 
http://service.real.com/help/library/guides/proxy2/proxy.htm, and see the ReadMe 
document that accompanies RealProxy. This ReadMe file is continuously updated; you can 
always find the most up-to-date version of it at 
http://service.real.com/help/library/guides/proxy2/readme.htm. 


The Evolution of Streaming Media 


As the use of streaming media on the Internet has rocketed in popularity among users, the 
amount of this type of content has grown correspondingly. For example, every week there are 
more than 350,000 hours of RealAudio™ and RealVideo™ programming available. More 
than 1700 live radio stations broadcast using RealAudio®, and over 100 live television stations 
broadcast in RealVideo®. Indeed, audio and video content has been essentially transformed 
from a selection of entertainment offerings to a wide range of powerful business tools. 


While content has assumed a more central importance in the enterprise environment, the 
expanded adoption of broadband technology has also made this content more compelling, as 
increased bandwidth makes it possible to stream more complex presentations. The challenge 
today for those administering intranet environments with streaming media is control—that is, 
managing the exchange of streaming media content in a measured, secured, cost-efficient 
manner that does not jeopardize mission-critical applications or quick access to important 
information. 
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This increased presence of streaming media places new demands on the management of 
network bandwidth. Streaming media not only consumes more bandwidth than do Web pages, 
it also requires a continuous uninterrupted flow of data to yield the best possible end-user 
experience, because the client/server connections are persistent. Unlike HTML, images, or 
downloadable files, streaming media depends critically on consistent and reliable packet 
delivery over complicated network paths spanning many segments, routers, and switches. 
Temporary delays (network congestion) and packet loss are more than inconvenient—they 
affect the smoothness of playback for the end user, and they may also lead to audio dropouts 
or poor video quality that compromise the overall user experience. 


As was mentioned briefly in the preceding section, the use of streaming media content 
presents several unique challenges: 


+ It is bandwidth intensive. The transmission rate of streamed content can be as low as 28 
kilobits per second (Kbps), but is now being encoded as high as 1 megabyte per second 
(MBps) on the Internet—and even higher in controlled environments. Unmanaged, this 
vast range of speeds has significant network implications. 


It requires an uninterrupted flow of data. For content to be worth watching, the end user must 
be able to receive a continuous flow of bits. The shorter the distance those bits have to 
travel, the better the end user’s experience will be. 


It requires different ports than does Web content. Streaming media travels by means of the Real 
Time Streaming Protocol, (RTSP), a standard that has been submitted for acceptance to 
the Internet Engineering Task Force (IETF) (http://www.ietf.org/), the protocol 
engineering and development arm of the Internet. RTSP defines UDP data channels that 
require additional ports to be opened, which affects issues such as firewalls, 
authentication, and security. 


It needs to protect broadcasters’ rights. Unlike with Web content, broadcasters of streaming 
media require that their content be protected and managed. This prevents streaming 
media caching from being as loosely managed as Web caching. 


In addition to the inherent challenges just described, those who administer corporate intranets 
need to concern themselves with the protection of their users. For obvious security reasons, 
most intranet networks are required to mask the IP addresses of individual users. Also, they 
must deal with the issue of firewall integration, as streaming media content requires different 
ports than does Web content. 


RealNetworks’ goal with Proxy 8 is to mitigate these challenges and to provide a reliable, 
controlled mechanism for delivering streaming media to receiver networks. One version of 
RealNetworks proxy technology has been publicly available since 1999 through original 
equipment manufacturer (OEM) partners, as part of integrated streaming media and Web 
caching solutions. This white paper discusses the new version, the stand-alone RealProxy retail 
product, which is specific to streaming media. However, the overarching technology is the 
same for both versions. 


Rationale for RealSystem Proxy 8 


For streamed content replication to be cost-effective, it must be simple to deploy, require 
minimal administration, be completely secure to protect intellectual property rights, and be 
able to work anywhere in the network without requiring preconfiguration of either the source 
server or the client. Proxy 8 meets all of these design parameters. 
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. . ™. 
Proxy 8 can store and serve content it receives from any RealSystem® Server or RealSystem® 


Proxy. When placed between the source server and the end user in the network, Proxy 8 
accepts content from other servers in response to user requests and then re-serves the content 
to end users. Subsequent requests for the same content are served from the proxy server with 
permission from the source server. Proxy caches for Web content are widely deployed on the 
Internet and in corporate intranets today, as they significantly reduce both bandwidth 
consumption and Web page delivery time. RealNetworks is evolving this same model to add 
on-demand caching and live stream replication to the rapidly growing percentage of Internet 
and intranet traffic that is streaming media. 


By placing Proxy 8 behind the firewall, the network administrator can control aggregate 
bandwidth consumption at any time for both live and on-demand activities. Proxy 8 has two 
modes to enable this: live and on-demand. 


In the live scenario, Proxy 8 acts as a splitter, receiving a single stream of popular content and 
broadcasting it to all internal RealPlayers® that have requested the content. The reduction of 


inbound streams, from one-to-many down to one-to-one, saves a significant amount of 
bandwidth. 


In the on-demand scenario, content that is requested internally is cached for future delivery, 
providing greater end-user quality and reducing inbound bandwidth usage. These scenarios 
work for the entire spectrum of content, whether internal or external to the network. They 
provide the network administrator with a high degree of control, and they make it possible for 
RealPlayer users to access high-caliber streamed content quickly and dependably. 


Proxy 8 provides a solution for everyone involved: 


- Broadcasters send fewer data streams while serving more clients, and they maintain 
complete control of the content, even when it is stored in the cache. 


- Users enjoy an enhanced playback experience. 


+ Network administrators are happy because their networks are used more intelligently and 
are less prone to “meltdown” from breaking news events. 
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A systemic overview of RealSystem Proxy 8 in a network environment 





al 1... 


RealPlayers RealPlayers RealPlayers 





Product Overview 


RealProxy is software you install on an enterprise network or ISP gateway to manage the 
delivery of streaming media. The following section explores its functionality in depth. 


Introduction to RealProxy 


RealProxy puts audio and video content closer to end users in an efficient, as-needed basis. The 
solution employs multiple geographically distributed RealProxy servers placed inside the 
firewall, on a receiver network (a network that receives streaming media). If the client requests 
content that exists on a nearby RealProxy, the data does not need to be resent from the source 
server, bandwidth is conserved, and quality-of-service (QoS) is optimized. If the content does 
not exist on the RealProxy, RealProxy fetches it, serves the client, and stores it for subsequent 
requests; no bandwidth or QoS benefits are realized for the initial request, but no penalty is 
paid. 

In traditional client/server relationships, each user request for a streaming media clip results in 
a new connection being established between the client and the source server. With the caching 
functionality built into RealProxy, however, only the first user request goes to the source server. 
Each subsequent request is served from the cache, eliminating redundant requests to the 
source server. As end users request new streaming media files, the cache stores the streaming 
content in a local file system. If another user requests the same content, RealProxy checks with 
the source server for authentication, and if granted, delivers the media from its data store. 


T™ architecture. Its 


RealProxy and its associated caching components are built on RealSystem 
streaming engine is the same engine used by RealServer. Thus, RealProxy is able to take 
advantage of the application programming interfaces (APIs) of RealSystem architecture to 


extend its unique functionality. 
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RealProxy always maintains a control connection, or accounting connection, to the source 
RealServer. The proxy server initiates data play to the requesting client only after this 
connection has been accepted by the source server. The source server treats this connection no 
differently than it would a connecting client. Statistics sent back to the source server record the 
duration of playback and the quality-of-service experienced by the client; these statistics are 
written to the source server’s access log. 


The RealProxy accounting connection ensures that the source server does not exceed its 
licensed connection capacity. RealNetworks server products come with a license that governs 
the maximum number of concurrent connections that a given server can support. By opening 
an accounting connection to the source server, the proxy server adheres to the stated 
connection capacity for that source server. If the source server has reached its connection 
capacity when the proxy server attempts to connect to it, the client is notified with the 
appropriate message, just as if it were communicating directly with the source server. Client 
connections look the same in the source server’s administration monitor and access logs, 
regardless of whether or not the clients are connecting through RealProxy. 


There are two primary modes supported by RealProxy, as described briefly in the following 
paragraphs. These modes are discussed more fully later in this white paper: 


+ Live splitting: RealProxy initiates a single data channel for live broadcasts from RealServer 
and replicates it to connecting clients. 


+ On-demand caching: Upon an initial request for on-demand content, RealProxy acquires 
media files from RealServer and stores them locally in its cache. Subsequent requests are 
served from this cache. 


In the event that client requests cannot be split or cached, RealProxy creates a pass-through 
connection to RealServer. While RealProxy always seeks the optimal delivery mode (splitting 
for live, caching for demand), playback is guaranteed to the RealPlayer in all cases. 


New RealSystem Proxy 8 Features 


Proxy 8 has improved authentication, routing, and caching. 


Proxy Authentication 


RealProxy authentication provides a way for you to control the sites visited by RealPlayer. With 
this feature, you can configure RealProxy to require a valid user name and password before 
allowing a RealPlayer to access a particular URL. 


You can restrict which users can access content originated from specific locations, or you can 
ensure that only certain users can play streaming media that originates outside your network. 
You create a list of the sites that all users can visit. If a user requests content from a site not on 
this list, she is asked for a user name and password. If you have previously created a user name 
and password for that person, she receives the media. If you haven't created a password, or if 
the user types it incorrectly, she is denied access. 


RealProxy identifies requests for secure content by the host name in the URL. 


For detailed information on authentication, see Chapter 12 in the RealProxy Administration 
Guide. 
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Proxy Routing 


Proxy routing enables you to route RealProxy requests through other RealProxy servers. The 
main RealProxy that handles requests bound for the Internet is called the parent proxy; the 

RealProxy servers located closest to the clients are called child proxies. This feature is designed 
specifically for enterprise scenarios in which subnet traffic is routed through proxy software. 


Chained Caching 

In a chained configuration, RealProxy caches media file in a cascading manner at both the 
parent and child proxy. Thus, when a RealPlayer requests media from the child proxy, the 
media will be cached at both the child and parent. This then ensures the most effective use of 
bandwidth because subsequent requests for that same media file by RealPlayers connecting to 
the parent proxy will not demand additional bandwidth consumption across the networks 
linking the parent proxy to the source RealServer. 


When a RealPlayer request is initiated at a child proxy, the parent proxy tunnels the live split 
broadcasts. This serves two purposes: it preserves broadcast quality of service closest to the 
requesting viewer, and it preserves bandwidth over the network path that links the parent 
proxy to the source RealServer. For detailed information on these two features, see Chapter 10 
in the RealProxy Administration Guide. 


Other RealSystem Proxy 8 Features 


Proxy 8 has a full set of features that interoperate with other RealSystem components, and 
ensure intelligent management of your streaming media. 


Proxy for RealPlayer 


This feature makes requests for content on behalf of RealPlayer users, and manages traffic 
inside the firewall by coordinating requests for similar content. This feature also masks end- 
user IP addresses. 


Splitting Support for Live Broadcasts 


Proxy 8 splits a single inbound broadcasting feed to multiple RealPlayers. Thus, it reduces 
inbound bandwidth usage to a single stream of content during a live event and improves the 
RealPlayer quality of experience 


Caching of RealSystem Content 


Proxy 8 caches all incoming streaming media traffic originating from a Server 8, and servers 
cache content locally after authenticating on the source server. This significantly reduces 
inbound bandwidth usage by eliminating redundant file transmissions across the network, 
and it improves RealPlayer quality of experience. 


Accounting Connection 


This feature authenticates every content request at the source server. The broadcaster can see 
all of the general usage data and can verify that his users are appropriately authenticated. The 
end users, meanwhile, are guaranteed the freshest content. 
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Aggregate Bandwidth Thresholds 


Caps inbound and outbound bandwidth to Proxy 8, thus controlling aggregate bandwidth 
usage within the network and preventing stress on mission-critical applications. 


Cross-Platform Support 
Proxy 8 is available for the following platforms: 
- Sun Microsystems Solaris 
+ Microsoft Windows NT and Windows 2000 


¢ Linux 


Summary of RealSystem Proxy 8 Benefits 
Deploying Proxy 8 in an enterprise network provides four main benefits: 
- Bandwidth savings 
+ Intelligent use of the network 
+ Security 
- Ahigh quality of service for end users 


Bandwidth Savings 


Because it eliminates redundant data, deploying Proxy 8 can result in significant cost savings. 
The return-on-investment case for reducing bandwidth consumption is both straightforward 
and compelling. The costs involved in Proxy 8 deployment include hardware procurement, 
software licensing fees, administration overhead, and administrator training. RealProxy has 
been designed from the ground up to minimize these costs. It supports a variety of operating 
systems, widening the range of hardware choices; and it is simple to install and administer, 
with minimal training. 

The extent of an enterprise’s savings depends largely on the cost of network bandwidth and on 
the amount of bandwidth reduced as a result of using Proxy 8. There are many different ways 
to measure (and be billed for) bandwidth cost. One straightforward metric is the cost per 
megabyte (MB) of data transferred; this falls in the range of pennies or fractions of a penny per 
megabyte. The amount of bandwidth saved is simply the difference between the number of 
megabytes per second (MBps) that come out of Proxy 8 and the number of MBps that go into 
it. For example, assuming 1 cent per megabyte as cost, with the in/out difference of Proxy 8 
averaging 5 megabytes, the cost savings would be $540 per day. The following table shows 
hypothetical cost savings per month for a range of bandwidth costs and bandwidth savings. 
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Total Bandwidth Savings per Month (in MBps) 




















Cost of 
Metered 
Bandwidth* 
(cents per 
MB 
transferred) 

1 MBps 5S MBps 10 MBps 15 MBps 20 MBps 
3 cents $3,348 $16,740 $33,480 $50,220 $66,960 
1 $1,116 $5,580 $11,160 $16,740 $22,320 
0.3 $335 $1,674 $3,348 $5,022 $6,696 
0.1 $112 $558 $1,116 $1,674 $2,232 
0.03 $34 $167 $335 $502 $670 

















(*For reference, a metered T-1 access line that costs $1,000 month and averages 40 percent 
of capacity equals 0.5 cents per megabyte transferred.) 


Network Management 


Proxy 8 enables network administrators to control the amount of inbound bandwidth it 
consumes and the outbound bandwidth it generates for connection requests. The proxy server 
regulates inbound bandwidth across its pass-through, splitting, and cache transfer 
mechanisms. Bandwidth is regulated in concurrent bits acquired and concurrent bits served. 
By managing these parameters, network administrators can ensure that even large broadcasts 
will not interfere with other mission-critical activities on the network. 


Security 


Like other proxy server applications, Proxy 8 masks end-user IP addresses, providing an 
additional layer of security for the network. 


End-User Quality of Service 


In both live and on-demand scenarios, an end user whose connection is situated behind a 
Proxy 8 will receive a quality of service on a par with or—more typically—superior to that 
experienced by other users. By bringing content topographically closer to the end user, Proxy 8 
significantly decreases the potential for the type of poor quality that can result from network 
congestion and packet loss occurring over the Internet. 


How RealSystem Proxy 8 Works 


Proxy 8 is an application designed to act as a proxy for the delivery of streaming media from 
the Internet or an enterprise intranet to a managed network. Proxy 8 optimizes data 
transmission by dynamically determining the best delivery method for each client request for 
streaming media. 


Note that Proxy 8 works for both live broadcasts and on-demand content. 
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Live Broadcasts 


This section discusses the two basic delivery methods that Proxy 8 supports for streaming live 
broadcasts to connected clients: splitting streams by means of either UDP or TCP unicasting or 
IP multicasting, and pass-through delivery. 


Splitting 


Unicasting 

After initiating a single data-channel connection to Server 8, Proxy 8 splits live broadcasts for 
any clients connected to it. Subsequent requests for the same live stream are then delivered 
from the Proxy 8, without pulling redundant live data from the source server. For each client 
requesting the live stream, Proxy 8 establishes an accounting connection back to Server 8. This 
accounting ensures that the RealPlayer is permitted to access the stream and that it forwards 
unique session statistics back to the source server. 


The establishment of the accounting connection to Server 8 enables Proxy 8 to attempt to split 
all live streaming media broadcasts. 


Proxy 8 splitting a live broadcast 


RealServer RealProxy RealPlayers 


_ fal 
live.cm ®lverm” SS 
ea -——-—> a 
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RealServer versions 6 and later are configured in a manner that permits Proxy 8 to split their 
live broadcasts. 


Multicasting 

Proxy 8 supports IP multicast. While Proxy 8 cannot join an existing IP multicast channel, it 
can rebroadcast a live split stream to its connecting clients by way of multicasts. IP multicasts 
require that: 


+ The network between the RealPlayer and Proxy 8 is IP multicast-enabled. 


+ RealPlayer is configured to attempt multicast reception for live broadcasts (this is the 
default configuration in all RealPlayers). 


+ Proxy 8 is configured to broadcast multicast channels on a defined IP address range. 


The method of multicasting supported by Proxy 8 is back-channel multicasting, which 
establishes a Server 8 accounting connection for each client. 


Pass-Through Delivery 


If live content cannot be split, Proxy 8 will simply pass the stream through to each connecting 
client, establishing both an accounting connection and a data connection for each client that 
has requested the live stream from Proxy 8. 
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In both the live-splitting and pass-through scenarios, Proxy 8 establishes and maintains the 
accounting connection to the source server. 


Proxy 8 in a pass-through scenario 





RealServer RealProxy Accounting RealPlayer: 
Connection é 
ee : 


On-Demand Content 


Proxy 8 supports two methods of delivering on-demand streaming media to connected clients: 
streaming from a local cache, and pass-through delivery. 


Caching 


Proxy 8 ships with a streaming media cache This enables on-demand content to be dynamically 
replicated locally, in an encrypted format. Proxy 8 attempts to store all cachable media files 
upon first request. 


When a Proxy 8 server receives a client request for on-demand media, it determines whether the 
content is cachable. Then it checks to see whether the requested media already resides in its 
local cache. If the media is not already in the cache, Proxy 8 acquires the media file from Server 
8 and simultaneously delivers it to the requesting client. 


Initial RealPlayer request fills the media cache 


RealSe Real RealPlayer 
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Subsequent requests for the same media clip can be served without repeatedly pulling the clip across the 
network from the source Server 8 


RealPI. 
RealServer = 


ooeceee oe 
\s 4 





Proxy 8 never attempts to stream data from cache unless it first establishes an accounting 
connection to the source Server. If at any time during a cache playback session, the source 
server goes offline, or becomes unreachable, the proxy server terminates its connection with 
the client. This way, the proxy server ensures that content delivered from its local cache is 
synchronized with the original version residing on the source server. Enforcement of the 
accounting connection also preserves the intellectual property rights of the publisher who is 
serving the content from the source server. 


The cache’s design goal was to provide a simple mechanism for storing and retrieving content 
locally. It has the following basic features: 


- Aconfigurable cache size 
- An established absolute path to the disk location where the cache resides 


- A cache-flush heuristic, based on the age of the content it was last retrieved 


Pass-Through Delivery 


Proxy 8 dynamically switches to pass-through mode for on-demand content if the client 
request is for media that is not cachable. This will occur if the source Server 8 is version 6 or 
earlier, or if the server administrator has explicitly marked the content as noncachable. 


Bandwidth Management 


Proxy 8 enables network administrators to manage streaming media bandwidth consumption. 
Each Proxy 8 server has configurable settings that: 


- Limit the amount of gateway bandwidth that Proxy 8 acquires from servers. 
- Limit the amount of client bandwidth that Proxy 8 generates to fulfill client connections. 


+ Limit the number of concurrent client connections that Proxy 8 will sustain. 


Configuration and Administration 


Proxy 8 is an application-level proxy server and is intended to be run on a computer system 
largely dedicated to its execution. You can administer all Proxy 8 features remotely by using the 
RealSystem Administrator, an HTML interface that enables an administrator to control and 
update Proxy 8. 
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You can download the final version of RealSystem Proxy 8 from the following Web address: 
http://www.realnetworks.com/products/proxy/. 


The Monitor page in the Proxy 8 Administrator 


real 





RealSystem Administrator 





Current RealProxy: 


The RealProxy monitors current client connections, the volume of inbound traffic 
to the Proxy and the volume of network traffic generated by the Proxy. 


Definitions: 


® Connected Clients is total connected PNA & RTSP clients 

e Client Traffic is total traffic generated by the RealProxy for RealPlayers 

@ Gateway Traffic is total traffic consumed by the RealProxy from 
RealServers 


Connected Clients 98 
Total Clients 
Served 1734 
Data Source Client Traffic Gateway Traffic 
Proxy 2,542,091 172,121 
Cache Import 900,891 
Splitter Import 64,810 
Total 2,542,091 1,137,822 


Deploying RealSystem Proxy 8 


The following section describes two prototypical deployments, with guidelines for configuring 
Proxy 8 in the network environment. 


An Enterprise Gateway and Remote Office Scenario 


The following scenario uses the example of a major corporation with numerous satellite 
offices around the world. It provides top-level recommendations for deploying Proxy 8 
successfully. 


There are three very important objectives to meet: 
+ Bandwidth optimization 


Optimize enterprise bandwidth use for streaming media, while ensuring that mission- 
critical intranets are not flooded with streaming media packet traffic. Conserve bandwidth 
use across costly links that connect the enterprise’s wide area network (WAN) to the 
Internet, and also conserve bandwidth use across dedicated links that connect remote 
offices to the primary corporate network. 


+ Security 


Allow streaming media traffic onto corporate networks without compromising strict 
intranet security. Filter or authenticate end-user access to this streaming media content, 
and ensure that employees comply with corporate policies regarding media consumption. 
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+ Quality of service 


Provide the highest possible quality of service for streaming media to enterprise end users, 
for both locally hosted and remotely hosted broadcasts. 


Network Description 


Internet access is established from the corporate headquarters’ local area network (LAN), with 
branch offices connecting to this LAN through fractional T1 communication links. The 
number of end users range from dozens to thousands. There is no direct desktop access to the 
Internet, and the corporation deploys application proxy servers that broker internal requests 
for externally hosted media and files. Moreover, application proxy servers must authenticate 
end users before those servers will make external requests on the end users' behalf. 

Because branch offices do not access the Internet directly, their Internet-bound traffic must 
traverse the link connecting them to the corporate LAN before being routed externally. 


An Enterprise Network 


10BaseT Ethernet 


Corporate DMZ Headquarters 


Real 
Server 
Real Public 
Server |[— Internet 
Real 
Server 







Border Router 






(extranet) 
RealPlayer(s) 


Fractional T1 
Link 


Remote Office 


RealPlayer(s) 


The corporation maintains a “demilitarized zone” (DMZ), into which Internet traffic from 
untrusted hosts beyond the corporate network can enter. A border router connects the DMZ 
network to the Internet. Hosts residing on the DMZ are assigned routable Internet addresses 
(Class A, B, or C). The corporation has chosen to run its extranet Web and streaming media 
servers in the DMZ to serve content to external customers and the general public. 


Straddling the DMZ are application proxy servers that broker internal requests for external 
files from the corporate end users. Because interior routers block these end users from sending 
or receiving Internet traffic, the proxy hosts are the only conduits available to desktop 
applications to enable them to reach external destinations. 
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Deployed RealSystem Products 


Proxy 8 is deployed as a gateway for all Internet-requested streaming media, and it is also 
deployed at the remote offices to optimize streaming media traffic that occurs over limited 
bandwidth connections tying the branch office to the headquarters LAN. 


RealPlayer Enterprise Edition is deployed on all desktops within the enterprise. The Enterprise 
Edition offers the same functionality as the basic RealPlayer. 


Server 8 is deployed on two of the corporation's networks. Intranet Webcasts are broadcast to 
end users from a Server 8 deployed on the headquarters LAN. External content is hosted and 
broadcast to customers, partners, and the general public from a Server 8 running in the DMZ. 


RealSystem Product Configuration 


RealPlayer Enterprise Edition 

Proxy 8 Configuration: Proxy 8 configurations are set for each desktop installation of the 
RealPlayer so that the local proxy specific to that LAN is used, while end users on the 
headquarters LAN use the Proxy 8 on the DMZ network. Branch office end users use the Proxy 
8 deployed on the branch office LAN. 


A proxy exception list is also configured in RealPlayer; this means that no proxy is used for end 
users on the headquarters LAN when they connect to the intranet Server 8. 


End users on the branch office LAN use their local proxy for all connections to the 
headquarters LAN Server 8, thus conserving bandwidth over the link that connects their 
offices to headquarters. 


The administrator can configure the bandwidth setting policy on a per-RealPlayer basis. This 
“locus of control” uses the connections setting that governs the maximum bandwidth a 
RealPlayer can request during its session. 


Neither of the servers in this scenario needs a unique configuration to function in the 


enterprise environment. 
Proxy 8 


It is important to note that for some features, Proxy 8 deployed in the corporate DMZ—the 
gateway proxy—is configured differently from Proxy 8 deployed in the branch offices. The 
following table describes these differences. 
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Feature 


Gateway Proxy 8 


Proxy 8 Enterprise Deployment Differences 


Branch Office Proxy 8 





Proxy Routing 


Not configured. 


Configured to use the Gateway 
proxy for all requested 
connections except those 
connections to the RealServer on 
the headquarters LAN. 


To create Proxy 8 routing rules: 


If no Server 8 resides on the 
branch office LAN, create a rule 
by which all destinations are 
routed to the parent proxy host 
name or the address of the 
gateway proxy. 


If a local Server 8 

does reside on the branch office 
LAN, add a rule that does not 
require URL requests to the local 
Server 8 to be routed to a parent 


proxy. 





Proxy Authentication 


Enabled and configured to 
authenticate all end users' 
according to corporate policy. 


To enable authentication: 


Create rules that will not 
authenticate connections made 
through the proxy to the 
extranet Server 8 that the 
corporation hosts in the DMZ. 


Not configured. 


Because the Proxy 8 that is 
deployed in the DMZ gateway 
authenticates end users’ 
connections for media, the 
branch office proxy passes end- 
user credentials up to the 
gateway proxy to enforce 
corporate access policies. 











(Table Page 1 of 2) 
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Bandwidth Management 


Enabled to implement the 
aggregate bandwidth allotment 
policy (if one exists) of 
headquarters LAN. 


To configure bandwidth 
management settings: 


Set the maximum bandwidth, 
maximum gateway bandwidth, 
and total concurrent connection 
settings to comply with 
corporate policies for streaming 
media bandwidth consumption. 


Proxy 8 Enterprise Deployment Differences 


Enabled to implement the 
aggregate bandwidth allotment 
policy (if one exists) of the 
branch office LAN. 


To configure bandwidth 
management settings: 


Set the maximum bandwidth, 
maximum gateway bandwidth, 
and total concurrent connection 
settings to comply with 
corporate policies for streaming 
media bandwidth consumption. 





IP Binding 


Enabled to listen for incoming 
connections on the interfaces of 
the host system that is 
configured to receiver RealPlayer 
connections from inside the 
corporate WAN. 


Proxy 8 will make outbound 
connections to external servers 
based on the routing 
configuration of the operating 
system of the host it is running 
on. 


To configure IP Binding: 


Make sure that all interfaces 
used to receive incoming 
connections from corporate end 
users' are configured. 


Make sure that the operating 
system of the host system will 
enable the proxy to make 
outbound connections from the 
appropriate interfaces so that it 
is able to connect to servers. 


Enabled to listen for incoming 
connections on the interfaces of 
the host system that is 
configured to receiver RealPlayer 
connections from inside the 
branch office LAN. 


Proxy 8 will make outbound 
connections based on the 
routing configuration of the 
operating system of the host it is 
running on. 


To configure IP Binding: 


Make sure that all interfaces 
used to receive incoming 
connections from corporate end 
users are configured. 


Make sure that the operating 
system of the host system will 
enable the proxy to make 
outbound connections from the 
appropriate interfaces so that it 
can connect to the headquarters 
LAN. 











(Table Page 2 of 2) 





16 


RealSystem iQ White Paper RealSystem Proxy 8 Overview 





RealProxy in an Enterprise configuration 


Corporate 
WAN 


Public ——sp>_—s 
Internet - = — > — 
Border Router 





An Internet Service Provider Access Point 


The second scenario uses the example of a large Internet service provider (ISP) with hundreds 
to millions of users. It provides top-level recommendations for deploying Proxy 8 successfully. 


The most important objectives to meet are the following: 
+ Bandwidth optimization 


Optimize bandwidth use for streaming media, especially over the expensive links that 
connect the service provider access point to “backbone” Internet providers. 


* Quality of service 


Provide the highest possible quality of service for streaming media subscribers, for both 
locally hosted and remotely hosted broadcasts. 


Network Description 


The access provider deploys a cluster of Proxy 8 servers behind a Layer-4 switching device. This 
Layer-4 switch intercepts and switches all packets bound for TCP port 554 (the known RTSP 
port) to a Proxy 8 host. Proxy 8 services requests for subscriber RealPlayers by accessing content 
hosted on the Internet. 


Proxy 8 in an ISP deployment 






RealPlayer(s) 


internet Server Provider Access Point eS 


RealPlayer(s) 
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Deployed RealNetworks Products 


Proxy 8 is deployed as a gateway for all RealPlayer-requested streaming media that is delivered 
over the access provider’s network. 


RealSystem Product Configuration 


RealPlayer 

There is no Proxy 8 configuration needed. RealPlayer is installed by each subscriber without 
the supervision of the access provider. RealPlayer requests for streaming media are served by 
Proxy 8 in a transparent manner; that is, the end user receives the files without knowing 
whether it is a Proxy 8 or a Server 8 handling the streaming. 


Server 8 
No unique configurations are required. The access provider does not have an association with 
the hosted content requested by its end users, or subscribers. 


Proxy 8 

You can configure a Layer-4 switch to transparently route RealPlayer requests for streaming 
media to a Proxy 8. However, this method of finding client proxies applies only to RTSP 
requests (the PNA protocol, much less commonly used nowadays, does not permit transparent 
client proxy finding). It assumes that the network topology is set up so that the Layer-4 device 
can intercept and switch all RealPlayer requests to a Proxy 8 host before they reach the 
intended destination Server 8. 


Specific configuration of the Layer-4 device will vary by vendor; consult the documentation for 
the switch you are using. To enable the proxy-finding method just described, the Layer-4 device 
must be able to readdress and overwrite TCP packet headers, based on a user-defined rule. 


In this scenario, Proxy 8 must also be configured to enable the RTSP redirector plug-in. The 
configuration variables you use to enable this plug-in are outlined in the following section. 
The RTSP redirector plug-in ships with Proxy 8, but it is disabled by default. 


Proxy 8 and a Layer-4 Switch 






RealServer 






RealPlayer 


Internet Service Provider Access Point 


Sequence of Events 
1. The client makes a request to rtsp://real.server.com/file.rm. 
2. The Layer-4 switch monitors all traffic from the client’s network, and it switches TCP- 


bound packets for all requests that specify “AnyHost port 554” so that they are sent to the 
Proxy 8 host and port 554. 


3. Proxy 8 has the RTSP redirector plug-in enabled and listening on port 554. The RTSP 
redirector plug-in issues an RTSP redirect message to the client connections it receives. The 
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RTSP redirect message contains the Proxy 8 host address and listening port used by the 
RTSP Proxy 8. 


4. The client receives the redirect message. It tears down its connection and makes a new 
connection to the Proxy 8 host address and port that was previously specified by the RTSP 


redirect message it received. 


5. The new connection is now between the client and Proxy 8. It is assumed that the Layer-4 
device will not intercept or switch traffic bound for the Proxy 8 host address and RTSP 


proxy port. 
Configuration Requirements 
Client 
Nothing is required, as the client is not configured to use a proxy. 


> To configure Proxy 8: 


1. On the <List Name="Proxy"> line, change <Var RTSPPort="554"/> to <Var 
RTSPPort="1091"/>. 


2. Add RTSP redirector plug-in settings to the root of the rmserver.cfg file: 


Warning 
Always make a backup copy of your configuration file before making any 


changes to it. 

<List Name="RTSPRedirector"> 

<Var Port="554"/> 

<Var RedirectToAddress="10.0.0.0"/> 

<Var RedirectToPort="1091"/> 
</List> 
Where “10.0.0.0” is the IP address of the Proxy 8 host. 
Layer-4 Switch 


Although the exact configuration will be different for each Layer-4 switch, depending on the 
vendor, there are some general guidelines should follow: 


- The device must support port-based switching of TCP traffic with the setting 
“AnyHost:554” to the Proxy 8 host address and the RTSP redirector plug-in port (which is 
554). 


+ When switching the TCP packet, the device must: 


+ Overwrite the packet’s IP header, making the Proxy 8 host address the destination 


address. 


+ Overwrite the packet’s TCP header, making port 554 the destination port, which is the 
port used by the RTSP redirector plug-in. 
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Protocols, Transports, and Packet Formats 


Summary 


Proxy 8 handles client requests and acts as a proxy for Server 8 media streams by using the Real 
Time Streaming Protocol (RTSP), the standards-based control protocol for streaming 
multimedia, and Progressive Networks Audio (PNA), the RealNetworks legacy protocol. Proxy 
8 is not an HTTP protocol proxy and thus does not handle any HTTP streaming media 
requests. 


RealSystem supports different types of data transports; these include IP multicast for live 
broadcasts, and UDP and TCP for both live and on-demand content. Proxy 8 works with 
connected RealPlayers to determine the best data transport type to use for a given content 
request. 


Data types that are streamed through RealSystem use two primary packet formats, RDT and 
RTP. RDT is a proprietary packet format native to Server 8. RTP is an Internet-standard data 
type packet format. Proxy 8 supports both of these packet formats, and will dynamically 
determine and use the appropriate packet format for the type of data being streamed. 


The following table outlines the various protocols, transports, and packet formats that Proxy 8 
supports.: 


Protocols, Transports, and Packet Formats Supported by Proxy 8 




















Streaming Media 
Streaming Media | Control Protocol | Data Packet Data Packet Supported by 
Control Protocol | Transport Format Transport Proxy 8? 
RTSP TCP RDT IP multicast, Yes 
(RealNetworks) | UDP, TCP 
RTSP TCP RTP IP multicast, Yes 
UDP, TCP 
PNA TCP RDT UDP, TCP Yes 
(RealNetworks) (RealNetworks) 
PNA TCP RTP UDP, TCP Yes 
(RealNetworks) 
HTTP TCP = - No 
(Streaming) 
HTTP TCP RDT TCP No 
(Cloaking) (RealNetworks) 
RTP 

















Proxy 8 is a proxy server application that has been designed to work hand-in-hand with Server 
8 and RealPlayer, managing and retransmitting streaming media in an intelligent, reliable 
manner. It integrates with existing networked systems to provide high-quality streaming media 
performance and a high degree of control over networks. 


Proxy 8 dynamically determines the optimal mode of operation in both live and on-demand 
scenarios. The result for the network owner is bandwidth savings, control over his or her 
network, increased security, and a better experience for the end user. For network professionals 
building a streaming media architecture, Proxy 8 provides the means to effectively manage 
streaming media distribution. 
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Additional Resources 


- This guide fully documents RealSystem Proxy 8®. It explains how, in large-scale network 
deployments, Server 8 works in tandem with Proxy 8 to reduce network traffic by 
eliminating redundant requests. You will find this book at: 
http://service.real.com/help/library/guides/proxy2/proxy.htm 


+ You can download the actual Proxy 8 product at: 
http://www.realnetworks.com/products/proxy/ 


- Setting up servers to stream files past firewalls is a commonly performed task. 
Documentation on how to do this is presented at: http://service.real.com/firewall/ 


+ You can e-mail our Technical Support team at any time. For the specifics, see the Technical 
Support form at: http://service.real.com/contact/email.htm 


Appendix: Proxy 8 Connectivity Requirements 


You can use the two RealNetworks streaming media protocols—PNA and RTSP—with any type 
of packet format and transport for streamed media connections between clients and servers 
and between proxies and servers. 


The characteristics of the connection requirements between RealProxy and RealPlayer are 
identical to those between RealServer and RealPlayer. The tables and diagrams in this section 
outline the characteristics of the various types of connections you can set up between 
RealProxy and RealServer. 


Pass-Through Delivery: Live or On-Demand Content 


Proxy 8 and Server 8 Connection Characteristics 

















Control Protocol and RealServer Proxy 8 
Data Transport Support Interoperability Supported? 
PNA UDP RealServers 5 and earlier Yes 

PNA TCP RealServer 5 and earlier Yes 

RTSP UDP RealServer 6 and later Yes 

RTSP TCP RealServer 6 and later Yes 





RDT Data Playback/UDP Transport 
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Connection Legend | Description 


+ | $$ | Full-duplex TCP streaming media control connection. 


Simplex UDP channel used for delivering strearning media. 


Simplex UDP channel used to request resends for packets lost 
over the data delivery channel. 


RTP Data Playback/UDP Transport 
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| Connection Legend | | Connection Legend | Description 


——— Full-duplex TCP streaming media control connection. 


Simplex UDP channel used for RTP data delivery. 

Duplex UDP channel used to send synchronization information 
from Server 8 to Proxy 8, and to send packet loss information 
from Proxy 8 to Server 8. 


RDT or RTP Data Playback/TCP Transport 





Proxy 8 Server 8 


Connection Legend | Description 





4 single full-duplex TCP connection is used for both streaming 

<¢—__—______» media control and data delivery of either RDT or RTP packets. 
The data channel is interleaved with the protocol contral 
connection, 
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Proxy Splitting: Live Content 


Control Protocol and 
Data Transport Support RealServer Interoperability | Proxy 8 Supported? 





RTSP UDP RealServer 7 and later Yes 
RTSP TCP RealServer 7 and later Yes 





RDT Data Playback/UDP Transport 





Splitter control channel 


Client connection channel 


Connection Legend 


RTSP splitter control channel: full-duplex TCP streaming 
media control connection used to establish the master 
‘ ; connection between Proxy 8 and Server 8 for the split data. 

Only one splitter control channel exists between Proxy 8 and 
Server 8, regardless of the number of unique RealPlayers 
being served the live stream by the proxy server. 

<¢—________» RTSP connection control channel: full-duplex TCP streaming 
media control connection established by Proxy 8 for each 
unique RealPlayer connecting to the live split broadcast. This 
connection is used to account for each player at the source 
Server 8. 
Simplex UDP channel used for delivering streaming media. 
One UDP channel is established per live stream. Only one 
split data channel exists between Proxy 8 and Server 8, 
regardless of the number of unique RealPlayers being served 
the live stream by the proxy server. 
Simplex UDP channel used to request resends for packets lost 
over the data delivery channel. Like its companion data 
channel, only one resend channel is established between 
Proxy 8 and Server 8. 





RTP Data Playback/UDP Transport 

This scenario is identical to that described and illustrated in the preceding RDT section, except 
that here the UDP resend channel is full duplex and is used to send synchronization 
information from the source server to the proxy, and to send packet loss information from the 
proxy to the source server. 
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RDT or RTP Data Playback/TCP Transport 


You can configure the Proxy 8 splitting mechanism to establish a TCP connection to the 
source server for the acquisition of live split data. 


Interleaved splitter control 
Proxy 8 _ and data channel - 









Client connection channel 


Connection Legend | Description 


Interleaved splitter control and data channel: single full-duplex 
TCP connection is used for both the RTSP streaming media 
control and data delivery of either RDT or RTP packets. The 
data channel is interleaved with the protocol control 

4 > connection. 
When Proxy 8 is configured to use TCP for the splitter data 
transport, this interleaved channel is established between the 
proxy and source server, Only one interleaved channel exists, 
regardless of the number of unique RealPlayers being served 
the live stream by the proxy server, 

an 


RTSP connection control channel: full-duplex TCP streaming 
media control connection established by Proxy 8 for each 
unique RealPlayer connecting to the live split broadcast. This 


connection is used to account for each Proxy 8-connected 
player at the source server that is generating the live 
broadcast. 


Proxy Splitting: IP Multicasting to Connected RealPlayers 


Control Protocol and RealServer 
Data Transport Support Interoperability RealProxy Supported? 





RTSP IP Multicast RealServer 7 and later Yes 


Proxy 8 can generate an IP multicast for its connected RealPlayers, serving the live content that 
the proxy server has acquired through a live pull-split stream. Because Proxy 8 supports back- 
channel multicasting, it initiates a distinct RTSP accounting connection to the source Server 8 
for each RealPlayer joined to its IP multicast. 


For Proxy 8 IP multicasts, the connection characteristics between Proxy 8 and Server 8 are 
identical to those for Proxy 8 pull splitting. By default, Proxy 8 does not attempt to broadcast 
IP multicast packets when it has acquired a live pull-split stream. For information on enabling 
this feature, see the RealProxy Administration Guide at 
http://service.real.com/help/library/guides/proxy2/proxy.htm. 
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Caching of On-Demand Content 


Proxy 8 acquires files from Server 8 through a reliable TCP connection that it establishes when 
it receives RealPlayer-initiated requests for cachable streaming media. The cache acquisition 
connection is persistent during the entire playback of content from the cache. This is necessary 
to verify that the stream in the cache mirrors the corresponding file that resides on the source 
server. 


In addition to the cache acquisition connection, Proxy 8 maintains persistent accounting 
connections to the source server, corresponding to RealPlayer requests. The accounting 
connections use either the PNA or RTSP protocol, depending on the control protocol used by 
the source server to stream the file. 


Control Protocol and 
Data Transport Support | RealServer Interoperability | Proxy 8 Supported? 


PNA or RTSP UDP RealServer 7.and later Yes 
PNA or RTSP TCP RealServer 7 and later Yes 














RDT or RTP Data Playback of Cache Media 


PN& or RTSP accounting 
connection 
Proxy 8 


Cache acquisition connection 


Connection Legend | Description 


PNA or RTSP accounting connection: full-duplex TCP streaming 
<<_—____———_+ media control connection established by Proxy 8 for each 
unique RealPlayer requesting cachable media. This connection 
is used to account for each player connected to Proxy 8 at the 
source server that is hosting the cachable media file. 
_—— 










Cache acquisition connection: full-duplex data transfer 
connection established by Proxy 8 to acquire files and store 
them in the cache. 
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B bandwidth 
The amount of data that can be sent 


to a given computer over a short time, 
usually expressed as kilobits per 
second (Kbps). The higher the 
bandwidth, the faster the computer 
receives data—very much like using a 
larger garden hose to get more water 
faster. 


C secache hit rate 
The fraction of all requests that can 


be fulfilled from Proxy 8’s built-in 
media cache. 


client 
A software application that receives 
data from a server. For example, a 
Web browser is a client of a Web 
server, and RealPlayer is a client of 
Server 8 or Proxy 8. 


F firewall 
A security device used to protect a 


company from unauthorized access 
to its servers. A firewall ensures that 
all communication between an 
organization’s internal network and 
the Internet conforms to the 
organization’s security policies. It 
does this by using either proxy 
services or packet filtering. 


H HTTP 
Hypertext Transfer Protocol. The 
command and control protocol used 
by Web servers to communicate with 
Web browsers. 


| IP multicasting 
A method of broadcasting events to 


multiple destinations over the 
Internet. In this mode, a single 
computer can create the content (a 
concert or a film, for example) and 
deliver the stream to many computers 


simultaneously. 


L live splitting 
A method of data delivery in which 
Proxy 8 serves a single live stream to 
multiple clients. Proxy 8 opens a 
separate accounting connection to 


the source server for each client. 


live multicasting 
A method of sending a single live 
stream to multiple clients, rather 
than sending a separate stream to 
each client. If Proxy 8 is configured 
with live splitting enabled and the 
network supports multicast delivery, 
you can configure Proxy 8 to transmit 
IP multicast data to all of its 
connected clients. 
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M 


N 


O 


P 


media cache 
The Proxy 8 cache plug-in that 


enables Proxy 8 to store on-demand 
co, from where it can be accessed to 
fulfill subsequent client requests. 


Neuralcast Technologies 
Neuralcast Technologies aggregate 


the capacity of many servers into the 
power of one, creating a self-aware 
network where all servers seamlessly 
talk to each other and make 
instantaneous decisions about 
capacity sharing, optimization, and 
redundancy. Proxy 8 is an integral 
component of this network. 


origin RealServer 
See source RealServer 


PNA 
Progressive Networks Audio. A 
proprietary protocol that Server 8 
supports for backward compatibility 
with RealSystem versions 3 through 
5. URLs using PNA start with 
pnm://. 

pull splitting 
A method of streaming media 
delivery in which the link on the Web 
page lists both the splitter and the 
source server. When the splitter 
receives a request for the live audio or 
video file, it opens a connection to 
the source server, which then streams 
the file to the splitter, which, in turn, 
streams it to the requesting client. 


push splitting 

A method of streaming media delivery in 
which a constant connection is 
maintained among the splitters and the 
push source server, resulting in faster 
connections for the first client that 
requests a given split stream. 


quality of service (QoS) 
The actual quality of the end-user 


experience, measured by how closely 
the experience reproduces the 
playback experience when no network 
is involved (for example, playing 
content from a local hard disk). 


RDT 
Real Data Transport. The proprietary 
data package protocol that Server 8 
uses (along with RTSP) when 
communicating with RealPlayer. 
RTP 
Real-Time Protocol. The open, 
standards-based, data-package 
protocol that Server 8 uses (along 
with RTSP) to communicate with 
RTP-based clients. 


RTSP 
Real-Time Streaming Protocol. The 
client/server standards-based 
protocol designed specifically for 
serving multimedia presentations. 
Only by using RTSP can you deliver 
SureStream/™ files, whose multiple- 
bandwidth capability enables them to 
serve each connected computer 


according to its available bandwidth. 
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receiver network languages, or protocols. UDP is faster 
A company’s wide area network than TCP but is often less reliable. 
(WAN) that receives streaming media 
from RealProxy and broadcasts it to W_Webcache 
clients (RealPlayers, for instance). A cache designed to store HTTP- 
replication controlled objects (such as HTML, 
The automated creation of multiple GIF, and JPG files), as opposed to a 
copies of a live or on-demand streaming media cache, which stores 
streaming media file, at a point in the audio and video files. 
network between the source server Webcast 
and the RealPlayers. A broadcast that is delivered over the 
Internet. Participants can view and 
S source Server 8 hear streaming media, and they can 
A server that stores streaming media participate in real-time online chats. 


files and serves them to Proxy 8 on 
request. In the context of 

RealNetworks documentation, the 
generic source server is synonymous. 


streaming media 
Large audio, video, or animation files 


that are broken up into smaller 
chunks, or data packets, and 
delivered by a server to users in such a 
way that the users can play them 
immediately, rather than having to 
wait for the entire files to finish 
downloading. 


T TCP 
Transmission Control Protocol. One 


of the TCP/IP group of information 
languages, or protocols. TCP is more 
reliable than UDP but is often slower. 


U UDP 
User Datagram Protocol. One of the 


TCP/IP group of information 
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